CVE-2019-9514: Denial of Service Vulnerability in nodejs
Summary
CVE-2019-9512: Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Affects nodejs across 2 version ranges.
< 10.16.3-r0
>= f6fc46e03674ab1896792b7363ecac0665b5e0c5, < eb66efd6052801e2f10360c51787569da0185808
Fixed in 10.16.3-r0. How to fix ↓
Also tracked for
- stdlib · Go
- golang.org/x/net · Go
- golang.org/x/net · Go
The same CVE-2019-9512 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable and high-performance applications. However, certain versions of Node.js are vulnerable to a denial of service attack due to an issue in the HTTP/2 implementation.
Vulnerability Detail
The vulnerability, identified as CVE-2019-9514, arises from a reset flood attack in HTTP/2 implementations. An attacker can exploit this vulnerability by opening multiple streams and sending invalid requests over each stream. This triggers a stream of RST_STREAM frames from the peer. Depending on how the peer handles these frames, excessive memory and CPU resources can be consumed, leading to a denial of service condition. The impact of this vulnerability can range from increased resource usage to complete unavailability of the affected service.
How To Fix
Minimum fixed version
10.16.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can disable HTTP/2 support in their Node.js applications. By disabling HTTP/2, the vulnerability can be mitigated. However, this may impact the performance and capabilities of the application. Here is an example of how to disable HTTP/2 in a Node.js application:
const http2 = require('http2');
const server = http2.createServer();
// Disable HTTP/2
server.on('stream', (stream, headers) => {
stream.respond({
':status': 200,
'content-type': 'text/plain'
});
stream.end('Hello World');
});
Conclusion
CVE-2019-9514 is a denial of service vulnerability in Node.js due to a reset flood attack in the HTTP/2 implementation. It is crucial to update Node.js to version 10.16.3-r0 or later to mitigate this vulnerability. Disabling HTTP/2 support can also serve as a temporary workaround. For more information and assistance, reach out to DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
The vulnerability can lead to a denial of service condition, consuming excessive memory and CPU resources. This can result in degraded performance or complete unavailability of the affected service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time alerts for open-source vulnerabilities.
Yes, updating the Node.js package to version 10.16.3-r0 or later will fix this vulnerability. It is recommended to keep your Node.js installation up to date to ensure security.
Yes, disabling HTTP/2 support in your Node.js application can mitigate this vulnerability. However, this may impact the performance and capabilities of your application.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in securing your Node.js applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
